WHAT IS CLAIMED IS: 



1. Risk management software embodied upon a 
computer-readable medium, the software comprising a 
set of instructions for the following steps to be 
performed when the software is executed: 

a) accessing project data consisting of a 
plurality of actions to be performed; 

b) analysing the project data to identify a 
plurality of activities to at least some of 
which is assigned at least one risk 
indicator; 

c) on the basis of one or more mitigating task, 
identified to reduce or prevent a risk or 
the consequences of a risk, outputting to 
the project data one or more new actions or 
alterations to existing actions in the 
project data; and 

d) accessing changes to the project data and 
revising the plurality of activities in 
dependence on whether the changes are to 
actions in the project data resulting from 
step c) above . 

2. Risk management software as claimed in claim 1, 
wherein the changes to the project data are compared 
with new actions or alterations to existing actions 
previously output to the project data and where the 
changes to project data relate to actions previously 
output to the project data no revisions are made to 
the plurality of activities. 

3. Risk management software as claimed in claim 1, 
comprising the step of receiving a trigger from the 
project data when the project data has been changed. 



4. Risk management software as claimed in claim 1, 
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comprising the step of periodically polling the 
project data to determine whether changes have been 
made to the project data. 

5 5. Risk management software as claimed in claim 1, 
comprising the further step of automatically 
outputting a message to one or more predetermined 
recipients . 

10 6. Risk management software as claimed in claim 5, 
comprising the further step of automatically 
outputting a message to one or more predetermined 
recipients when the consequences of a risk are 
identified as exceeding a selected threshold. 

15 

7. Risk management software as claimed in claim 5, 
wherein the message is automatically output when the 
processor receives notice of an impacted risk. 

20 8. Risk management software as claimed in claim 1, 
wherein the risk indicator consists of one or more of 
a cost allowance and a time allowance. 

9. Risk management apparatus comprising a risk 
25 processor; means for linking the risk processor to a 
risk data store; a project data interface for linking 
the risk processor to a second store containing 
project data; and a program store containing a set of 
instructions for performing the following functions: 
30 a) accessing project data in the second store, 

the project data consisting of a plurality 
of actions to be performed; 
b) analysing the project data to identify a 

plurality of activities to at least some of 
35 which is assigned at least one risk 

indicator and storing the plurality of 
activities in the risk data store; 



c) on the basis of one or more mitigating tasks 
identified to reduce or prevent a risk or 
the consequences of a risk, outputting to 
the second store one or more new actions or 
alterations to existing actions in the 
project data; and 

d) accessing changes to the project data and 
revising the plurality of activities stored 
in the risk data store in dependence on 
whether the changes are to actions in the 
project data resulting from step c) above. 

10. Risk management apparatus as claimed in claim 9, 
wherein the risk data store and the second store 
utilise the same database. 

11. Risk management apparatus as claimed in claim 9, 
further comprising a network interface for connecting 
to the second store when located at a remote site. 

12. Risk management apparatus as claimed in claim 9, 
wherein the functionality of the apparatus is divided 
into at least three parts: a presentational part for 
managing the presentation of risk information to a 
user of the apparatus; a logic part for analysing the 
project data and for generating and updating the 
contents of the risk data store; 

and an interface part for enabling communication of 
the apparatus with external applications and wherein 
the presentational part and the interface part are 
restricted to only interfacing internally with the 
logic part. 

13. Risk management apparatus as claimed in claim 12, 
wherein the apparatus includes a fourth part 
consisting of a risk data store interface which is 
permitted to interface with both the logic part and 



the interface part. 



14. A risk management method for storing and updating 
risk information, comprising the steps of: 

a) accessing project data consisting of a 
plurality of actions to be performed; 

b) analysing the project data to identify a 
plurality of activities to at least some of 
which is assigned at least one risk 
indicator; 

c) on the basis of one or more mitigating tasks 
identified to reduce or prevent a risk or 
the consequences of a risk, outputting to 
the project data one or more new actions or 
alterations to existing actions in the 

pro ject . data; and 
(d) accessing changes to the project data and 
revising the plurality of activities in 
dependence upon whether the changes are to 
actions in the project data resulting from 
the step (c) above. 

15. Integrated project management and risk management 
apparatus comprising : 

a project data store containing a plurality of 
inter-related project actions; 

a risk data store containing a plurality of 
inter-related project activities related to said 
project actions, and a plurality of risk indicators 
associated with said project activities; and 

a risk processor in communication with said 
project data store and said risk data store, said risk 
processor being operable to: 

read project actions from said project data 
store ; 

read project activities and associated risk 
indicators from said risk data store; 
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generate and write to said risk data store 
changes to said project activities and risk indicators 
to reflect the project actions read from the project 
data store; 

generate or receive, and write to said risk data 
store, one or more mitigating activities identified to 
reduce or prevent a risk or the consequences of a risk 
associated with a project activity; and 

generate and write to the project data store one 
or more new project actions, or alterations to 
existing project actions, corresponding to the 
mitigating activities generated or received. 

16. The apparatus of claim 15 wherein the risk 

15 processor is operable to identify and thereby not to 

further process changes in the project data which were 
generated by the risk processor. 

17. A method of operating an integrated project 

20 management and risk management apparatus comprising a 
project data store containing a plurality of inter- 
related project actions, a risk data store containing 
a plurality of inter-related project activities 
related to said project actions and a plurality of 

25 risk indicators associated with said project 

activities, and a risk processor in communication with 
said project data store and said risk data store, the 
method comprising the steps of operating said risk 
processor to: 

read project actions from said project data 
store; 

read project activities and associated risk 
indicators from said risk data store; 

generate and write to said risk data store 
changes to said project activities and risk indicators 
to reflect the project actions read from the project 
data store; 



30 



35 



generate or receive, and write to said risk data 
store, one or more mitigating activities identified to 
reduce or prevent a risk or the consequences of a risk 
associated with a project activity; and 

generate and write to the project data store one 
or more new project actions, or alterations to 
existing project actions, corresponding to the 
mitigating activities generated or received. 

18. A computer program product embodied on a 
computer-readable medium, the program product being 
for use in an integrated project management and risk 
management apparatus, and comprising: 

a project data store containing a plurality of 
inter-related project actions; 

a risk data store containing a plurality of 
project activities related to said project actions and 
a plurality of risk indicators associated with said 
pro j ect activities ; 

and a risk processor in communication with said 
project data store and said risk data store, said 
computer program product comprising computer program 
instructions which, when executed by said risk 
processor, carry out the method steps of claim 18. 



